% !TEX root =  acl_resilience.tex

As shown in Figure~\ref{fig:statechart}, when a book is published, it can be
ordered and archived by the secretary of the library and then can be borrowed
and returned by borrowers, including teachers and students. When a book is
already borrowed, other users may reserve it by being registered in a
reservation list. Reservers may also cancel their reservations. Access control
policies, embedded as the statechart's transition guards, secure these
business functions. For example, the transition from state \emph{Published} to
state \emph{Ordered} means the function ``order a book'' can be only executed
when the role is \emph{Secretary} while the context is \emph{WorkingDays} --
which satisfies the access control policy \emph{Permission(Secretary, Order,
Book, WorkingDays)}.